Bug 692690 - dirsrv pegs the CPU and stops answering requests when a large group is imported
dirsrv pegs the CPU and stops answering requests when a large group is imported
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: slapi-nis (Show other bugs)
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Nalin Dahyabhai
: 692599 (view as bug list)
Depends On:
  Show dependency treegraph
Reported: 2011-03-31 16:36 EDT by Stephen Gallagher
Modified: 2011-05-19 09:13 EDT (History)
4 users (show)

See Also:
Fixed In Version: slapi-nis-0.23-1.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2011-05-19 09:13:03 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
LDIF to add 75000 memberuid attributes to the largegroup (194.60 KB, application/x-gzip)
2011-03-31 16:36 EDT, Stephen Gallagher
no flags Details

  None (edit)
Description Stephen Gallagher 2011-03-31 16:36:41 EDT
Created attachment 489221 [details]
LDIF to add 75000 memberuid attributes to the largegroup

Description of problem:
I created a group with ipa group-add and then used ldapmodify to add 75,000 memberuid entries to it. When the compat plugin is enabled, the dirsrv process goes to 100% CPU and stops responding to requests. When the plugin is disabled, the import completes quickly.

Version-Release number of selected component (if applicable):


How reproducible:
Every time

Steps to Reproduce:
1. Set up a FreeIPA v2 server
2. Create a group 'largegroup' with the command 'ipa group-add --desc "large group" largeroup
3. Import the attached ldif with
ldapmodify -x -D "cn=Directory Manager" -W -H ldap://localhost < largegroup1.ldif
Actual results:
ldapmodify returns after a few seconds, but the dirsrv process starts using 100% CPU and stops replying to ldapsearch requests.

Expected results:
The ldif should be imported and further requests should complete as expected.

Additional info:
Comment 2 Nalin Dahyabhai 2011-03-31 17:52:16 EDT
Okay, apparently slapi_entry_merge_values_sv() got slower each time we called it to add a single attribute value to the entry being generated... very slow.
Comment 3 Nalin Dahyabhai 2011-03-31 18:17:13 EDT
In 0.23, the compat plugin will call slapi_entry_merge_values_sv() once per attribute per entry rather than once per value per attribute per entry.
Comment 5 Jenny Galipeau 2011-04-07 14:18:00 EDT

#time ldapmodify -x -D "cn=Directory Manager" -w Secret123 -h ipaqa64vmb.testrelm < largegroup1.ldif 
modifying entry "cn=largegroup,cn=groups,cn=accounts,dc=testrelm"

real	0m3.318s
user	0m0.066s
sys	0m0.050s

# ipa group-show --all largegroup
  dn: cn=largegroup,cn=groups,cn=accounts,dc=testrelm
  Group name: largegroup
  Description: largegroup
  GID: 167200006
  ipauniqueid: d6226490-6142-11e0-8bb5-021016980183
  memberuid: newuser170900000, newuser170900001, newuser170900002, newuser170900003, newuser170900004, newuser170900005, newuser170900006, newuser170900007, newuser170900008, ne
wuser170900009, newuser170900010, newuser170900011, newuser170900012, newuser170900013, newuser170900014, newuser170900015, newuser170900016, newuser170900017, newuser170900018,
 newuser170900019, newuser170900020, newuser170900021, newuser170900022, newuser170900023, newuser170900024, newuser170900025, newuser170900026, newuser170900027, newuser1709000
28, newuser170900029, newuser170900030, newuser170900031, newuser170900032, newuser170900033, newuser170900034, newuser170900035, newuser170900036, newuser170900037, newuser1709
00038, newuser170900039, newuser170900040, newuser170900041, newuser170900042, newuser170900043, newuser170900044, newuser170900045, newuser170900046, newuser170900047, newuser1
70900048, newuser170900049, newuser170900050, newuser170900051, newuser170900052, newuser170900053, newuser170900054, newuser170900055, newuser170900056, newuser170900057, newus
er170900058, newuser170900059, newuser170900060, newuser170900061, newuser170900062, newuser170900063, newuser170900064, newuser170900065, etc .................................................................................................................

version verified:

Comment 6 Jenny Galipeau 2011-04-07 14:19:06 EDT
to note: tested with replica and all replicated.
Comment 7 Stephen Gallagher 2011-04-11 21:04:24 EDT
*** Bug 692599 has been marked as a duplicate of this bug. ***
Comment 8 errata-xmlrpc 2011-05-19 09:13:03 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.